cowork-wordpress-expert

Session-aware per-step execution engine for /modify — surgical theme edits, WP-CLI content/plugin changes, lazy Docker startup, and versioned output on session completion

Install relevant WP.org plugins, generate AI placeholder content (pages, posts, menus), create placeholder images, and re-export the database for NL builds

Scaffold a blank WordPress installation with Docker MySQL, WP-CLI, SQL export, zip packaging, and build.json manifest

Scrape a URL with Playwright headless browser, check robots.txt and display copyright disclaimer, sanitise all content with AI-generated placeholders, detect dynamic features, and produce a clean HTML/CSS directory for the build-visual FSE pipeline

Generate a custom FSE block theme from structured HTML/CSS design exports or screenshot images — extracts design tokens, maps HTML to Gutenberg blocks, bundles Google Fonts, and produces an installable theme with custom-{slug} prefix

Initialize git repository at build root, generate dynamic .gitignore excluding WP core and known components, commit after each build stage with conventional prefixes

Generate SETUP.md with priority-ordered plugin configuration and content replacement guidance, and update build.json with NL-specific metadata

Select, install, and activate an FSE block theme from WP.org based on a natural language site description — queries API with full-site-editing tag, evaluates by relevance/popularity/rating, falls back to curated list

Install, activate, and configure the WordPress MCP adapter in a build — copy from vendor/, activate via WP-CLI, re-export the database, write README.md, and update build.json

Use when the user asks about WordPress codebases (plugins, themes, block themes, Gutenberg blocks, WP core checkouts) and you need to quickly classify the repo and route to the correct workflow/skill (blocks, theme.json, REST API, WP-CLI, performance, security, testing, release packaging).

Use when working with the WordPress Abilities API (wp_register_ability, wp_register_ability_category, /wp-json/wp-abilities/v1/*, @wordpress/abilities) including defining abilities, categories, meta, REST exposure, and permissions checks for clients.

Use when developing WordPress (Gutenberg) blocks: block.json metadata, register_block_type(_from_metadata), attributes/serialization, supports, dynamic rendering (render.php/render_callback), deprecations/migrations, viewScript vs viewScriptModule, and @wordpress/scripts/@wordpress/create-block build and test workflows.

Use when developing WordPress block themes: theme.json (global settings/styles), templates and template parts, patterns, style variations, and Site Editor troubleshooting (style hierarchy, overrides, caching).

Use when building or debugging WordPress Interactivity API features (data-wp-* directives, @wordpress/interactivity store/state/actions, block viewScriptModule integration, wp_interactivity_*()) including performance, hydration, and directive behavior.

Use when investigating or improving WordPress performance (backend-only agent): profiling and measurement (WP-CLI profile/doctor, Server-Timing, Query Monitor via REST headers), database/query optimization, autoloaded options, object caching, cron, HTTP API calls, and safe verification.

Use when configuring, running, or fixing PHPStan static analysis in WordPress projects (plugins/themes/sites): phpstan.neon setup, baselines, WordPress-specific typing, and handling third-party plugin classes.

Use for WordPress Playground workflows: fast disposable WP instances in the browser or locally via @wp-playground/cli (server, run-blueprint, build-snapshot), auto-mounting plugins/themes, switching WP/PHP versions, blueprints, and debugging (Xdebug).

Use when developing WordPress plugins: architecture and hooks, activation/deactivation/uninstall, admin UI and Settings API, data storage, cron/tasks, security (nonces/capabilities/sanitization/escaping), and release packaging.

Use when you need a deterministic inspection of a WordPress repository (plugin/theme/block theme/WP core/Gutenberg/full site) including tooling/tests/version hints, and a structured JSON report to guide workflows and guardrails.

Use when building, extending, or debugging WordPress REST API endpoints/routes: register_rest_route, WP_REST_Controller/controller classes, schema/argument validation, permission_callback/authentication, response shaping, register_rest_field/register_meta, or exposing CPTs/taxonomies via show_in_rest.

Use when working with WP-CLI (wp) for WordPress operations: safe search-replace, db export/import, plugin/theme/user/content management, cron, cache flushing, multisite, and scripting/automation with wp-cli.yml.

Use when building UIs leveraging the WordPress Design System (WPDS) and its components, tokens, patterns, etc.

Post-report aggregator that runs after report-generator writes latest.md to classify findings as NEW or RECURRING, patch inline badges, append a resolved-findings list, and persist trend data in memory/{site}/trends.json using a 2-slot scan rotation (current + prior). Never connects to WordPress, runs WP-CLI, or greps code files.

Integrates WP-CLI Profile command (wp-cli/profile-command package) for runtime performance timing. Shows stage breakdown (bootstrap/main_query/template) and top 5 slowest hooks. When the profile package is not installed, produces itemized Info findings for each skipped check and offers to install.

Reviews WordPress architecture for CPT misuse patterns (dead CPTs, data-store abuse via row count gating), hook abuse (excessive callbacks, expensive init hooks, priority conflicts), and caching anti-patterns (missing persistent object cache, permanent transients). CPT checks require WP-CLI; hook and cache checks are static analysis on synced files. Each section self-gates independently.

Detects potential N+1 query patterns in custom WordPress theme and plugin PHP code using three confidence tiers (High/Medium/Low). Skips well-known third-party plugins. Provides rewrite suggestions using actual variable names extracted from the code.

Analyzes WordPress wp-cron scheduled events for health issues including overdue events (>1 hour), duplicate hook registrations, and excessively frequent intervals (<5 minutes). Requires WP-CLI. Self-gates when WP-CLI is unavailable.

Synthesizes findings from all diagnostic skills into a bullet-point health narrative grouped by domain (Security, Code Quality, Database Health, Performance, Architecture, Infrastructure). Applies the standard A-F grading matrix and produces a "Top 3 issues to fix first" ranked list. MUST run last in the skill sequence — it reads COMBINED_FINDINGS from all preceding skills.

Analyzes WordPress post revision accumulation by counting total revisions, breaking down counts by parent post type via SQL JOIN, checking the WP_POST_REVISIONS constant for all four possible values (unlimited/true/false/number), computing a post count for per-post averages, and estimating database savings from setting a revision limit of 10. Uses dynamic table prefix via wp db prefix and routes all DB access through WP_CLI_PREFIX.

Checks WordPress file permissions via SSH for security misconfigurations — audits wp-config.php, .htaccess, wp-content/uploads/, and debug.log with per-file severity thresholds. SSH-only; skips with explanatory finding for non-SSH sources.

Detects WordPress transient buildup by counting live and expired transients via direct SQL with UNIX_TIMESTAMP() comparison, measuring total transient storage size, and computing the expired-to-live ratio for severity assessment. Uses dynamic table prefix via wp db prefix and routes all DB access through WP_CLI_PREFIX. Never uses wp transient list --expired (that flag does not exist).

Analyzes WordPress wp_options autoload bloat by measuring total autoloaded data size, listing all options above 10KB threshold sorted by size, and attributing each to known plugins via prefix matching. Uses dynamic table prefix via wp db prefix and routes all DB access through WP_CLI_PREFIX.

Audits HTTPS/SSL configuration for WordPress sites — checks siteurl/home URL schemes and FORCE_SSL_ADMIN via WP-CLI (when available), and scans all PHP/JS files for hardcoded http:// mixed-content URLs in local codebase.

Structured context gathering before diagnostics — asks about symptoms, timeline, environment, scope, urgency, and prior work to produce a focused investigation plan

Post-diagnostic verification — checks that findings address the original concern, skills ran as planned, and results are internally consistent

Pre-diagnostic SSH reconnaissance — gathers environment data, recent changes, error logs, and server health to inform diagnostic skill selection and focus areas

Compiles diagnostic findings from all diagnostic skills into structured markdown reports with health grades (A-F), executive summaries, categorized findings, and archives them in memory/{site-name}/ with latest.md and archive/ rotation.

Scans locally synced WordPress files for suspicious code patterns and potential malware using pattern matching. Detects obfuscation chains, backdoor signatures, suspicious file placements, and dangerous function usage with false positive reduction.

Audits WordPress user accounts for security issues (default admin username, excessive administrators, inactive privileged users)

Performs AI-powered code quality analysis on custom WordPress code (active theme + custom plugins) using a two-pass tiered approach - quick pattern scan for known anti-patterns, followed by deep AI contextual analysis on flagged files.